BROOKSTONE TRADE LIMITED
Sourcing Value. Delivering Trust.
Privacy Policy
Effective date: 8 August 2026 · Controller: Brookstone Trade Limited (Company No. 16914827)
1. Who We Are
Brookstone Trade Limited (“Brookstone”, “we”, “us”, or “our”) is a registered company (Company No. 16914827), with its registered office at 16 Oaklands Wood, Hatfield, AL10 8LU, England.
We operate a trade-portal application (“the Platform”) used to manage customer onboarding, pricing, orders, invoicing, and supplier communications. We are the data controller for all personal data processed through the Platform.
Questions about this policy or your data rights should be directed to privacy@brookstonetrade.com.
2. What Personal Data We Collect
2.1 Customer Onboarding
When a prospective customer submits an onboarding application we collect:
| Primary email address | For OTP verification and digital signature delivery |
| Full company name & trading name | Company identification |
| Company type & registered number | Legal entity verification via available company registries |
| Type of business | Account classification |
| Registered office, trading & billing addresses | Correspondence and delivery |
| Accounts contact: name, phone, email | Invoice and payment communication |
| Sales contact: name, phone, email (optional) | Order communication |
| Director / Proprietor name & capacity | Signatory identification |
| Director / Proprietor email & phone (optional) | Signatory contact |
| Bank account name, bank name, sort code, account number | Payment processing and credit assessment |
| Trade references (1–2) | Credit assessment |
| Name and job title of the person accepting terms | Terms acceptance audit trail |
Bank details are stored at rest in our database. They are accessible only to authorised Brookstone admin users and are used solely for payment and credit assessment purposes.
2.2 Company Registry Data (where available)
For eligible company types and countries, we may query a public company registry API using the registration number you provide. We retrieve and store company details such as the company name, registered address, and company status as part of your onboarding submission. You select your type of business separately from the options provided in the onboarding form. Where officer names and roles are available, they may be displayed for selection; the name and capacity you select are also stored in your submission. We do not store date of birth, nationality, country of residence, or identity verification details returned by registry APIs.
2.3 Platform Users (Staff & Suppliers)
| Email address | Authentication and account identification |
| Display name | In-app identity |
| Phone number (optional) | Contact details |
| Role (admin / supplier / viewer) | Access control |
| Account creation and last sign-in timestamps | Security auditing |
2.4 Orders & Invoicing
Each order record contains denormalised customer contact details (name, email, phone, address) and supplier name at the time of order creation. Payment records include the email of the staff member who recorded the payment.
2.5 Digital Signature Sessions
| Signer name and email | Identity of the person signing |
| One-time passcode (OTP) | Email-based identity verification; not stored after use |
| IP address and user-agent string | Non-repudiation audit trail for the signed document |
| Signing timestamp and confirmation code | Legal evidence of signing event |
2.6 Audit Logs
All significant actions on the Platform (creating, editing, or deleting users, customers, orders, and prices) are logged with the actor's user ID and email, a timestamp, and the nature of the change. IP addresses may be included.
2.7 Login & Bot Detection
Login attempts are protected by Google reCAPTCHA v3. A risk score is computed client-side using behavioural signals and sent to Google's servers for verification. We receive only a numeric score; we do not store it. Google's use of data collected during reCAPTCHA is governed by Google's Privacy Policy.
3. How We Use Your Personal Data
| Purpose | Lawful Basis (Applicable Privacy Law) | Data Used |
|---|---|---|
| Processing and reviewing your onboarding application | Contractual necessity (Art. 6(1)(b)) | All onboarding fields |
| Conducting credit assessment | Legitimate interest (Art. 6(1)(f)) | Bank details, trade references, company registry data |
| Identity verification of the signatory via email OTP | Contractual necessity | Email, OTP, IP, user-agent |
| Creating and managing your customer account | Contractual necessity | Company name, addresses, contact details |
| Issuing invoices and processing payments | Contractual necessity | Customer contact details, bank details, order data |
| Sending invoice, statement, and payment emails | Contractual necessity | Customer email, order details |
| Syncing invoices and contacts with Xero | Legitimate interest — accounting obligation | Customer name, email, invoice amounts |
| Managing platform user accounts | Legitimate interest — operational security | User email, name, role, phone |
| Maintaining audit logs for security and compliance | Legitimate interest — legal compliance | User email/UID, action, timestamp, IP |
| Detecting fraudulent login attempts (reCAPTCHA) | Legitimate interest — security | Behavioural signals, risk score |
| Providing non-repudiation evidence for signed documents | Legal obligation / legitimate interest | Signer name, email, IP, timestamp |
4. Third-Party Services
We share personal data with the following third-party processors only to the extent necessary to operate the Platform:
| Processor | Purpose | Data Transferred | Location |
|---|---|---|---|
| Google Firebase | User authentication, database, and file storage | Email, UID, roles, all stored business data | EU / USA (SCCs) |
| Vercel | Application hosting and serverless functions | Server-side request logs only | USA (SCCs) |
| Resend | Transactional email delivery | Recipient email, name, invoice/order content | USA (SCCs) |
| Google reCAPTCHA v3 | Bot/fraud detection on login | Behavioural signals, IP address | USA (SCCs) |
| Xero | Accounting software integration | Customer name, email, invoice amounts, payment status | New Zealand / USA (adequacy/SCCs) |
| Companies House (UK Gov, for UK company checks only) | Company verification during onboarding | Company registration number (lookup only) | UK |
| Open Exchange Rates | Currency conversion rates | None — rate data only, no PII | USA |
Where cross-border transfers occur, we rely on applicable transfer safeguards such as adequacy decisions, Standard Contractual Clauses (SCCs), and equivalent lawful transfer mechanisms.
5. Cookies and Local Storage
The Platform uses Firebase Authentication, which stores a JWT access token and a long-lived refresh token in your browser's localStorage (or sessionStorage for session-only sign-ins). These tokens contain your user ID, email, and role, and are used solely to authenticate API requests. They are cleared when you sign out.
We do not use advertising cookies, tracking pixels, or analytics cookies. The reCAPTCHA widget may set a Google cookie; this is governed by Google's cookie policy.
6. Data Retention
| Onboarding submissions (incl. bank details) | Duration of the business relationship + 6 years (for contractual/tax purposes) |
| Customer and order records | Duration of the business relationship + 6 years |
| Signed documents and signature events | 10 years (legal evidence) |
| Audit logs | 3 years |
| Platform user accounts | Until account is deleted or employment ends, then 1 year |
| OTP codes | Invalidated immediately after use or after 2-hour expiry |
| Signing session tokens | Expire after 2 hours |
We will securely delete or anonymise personal data when it is no longer required for the purposes listed above.
7. Data Security
We implement the following measures to protect your personal data:
- All data in transit is encrypted using TLS 1.2+.
- Firebase Firestore data is encrypted at rest by Google.
- Access to the Platform is protected by email/password authentication with reCAPTCHA bot detection.
- Role-based access control (admin / supplier / viewer) restricts data access to authorised users only.
- All data modifications are recorded in an immutable audit log.
- Signing sessions use email-delivered OTPs with a maximum of 5 attempts and 2-hour expiry.
- Bank details are visible only to admin users.
No system is completely secure. If you believe your data has been compromised, contact us immediately at privacy@brookstonetrade.com.
8. Your Data Protection Rights
You have the following rights regarding your personal data:
| Right of access (Art. 15) | Request a copy of the personal data we hold about you. |
| Right to rectification (Art. 16) | Ask us to correct inaccurate or incomplete data. |
| Right to erasure (Art. 17) | Ask us to delete your data where there is no overriding legal basis to retain it. |
| Right to restriction (Art. 18) | Ask us to restrict processing while a dispute is resolved. |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format (where processing is based on consent or contract). |
| Right to object (Art. 21) | Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds. |
| Right not to be subject to automated decisions (Art. 22) | We do not make solely automated decisions that significantly affect you. |
To exercise any right, email privacy@brookstonetrade.com with “Data Rights Request” in the subject line. We will respond within one calendar month.
9. Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with your local data protection authority. If you are in the UK, you may contact the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you contact a regulator.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The effective date at the top of this page will always reflect when the current version took effect. For material changes, we will notify affected users by email or by a prominent notice on the Platform.
Contact the Data Controller
Brookstone Trade Limited
16 Oaklands Wood, Hatfield, AL10 8LU, England
Company No. 16914827
Email: privacy@brookstonetrade.com